PT-2026-6920 · Unknown+1 · Webuploader+1

St1Tch · Publicado 2026-02-07 · Atualizado 2026-03-05 · CVE-2026-2113

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yuan1994 tpadmin versions up to 1.3.12

Description A security issue exists in yuan1994 tpadmin up to version 1.3.12. The issue is related to deserialization within the WebUploader component, specifically in the file /public/static/admin/lib/webuploader/0.1.5/server/preview.php. This can be exploited remotely. The exploit for this issue has been publicly disclosed. This vulnerability affects products that are no longer supported by the maintainer.

Recommendations Versions prior to 1.3.12 should not be used.

Exploit

Correção

Deserialization of Untrusted Data

Unrestricted File Upload

RCE

Enumeração de Fraquezas

CWE-502

CWE-434

CWE-20

Identificadores relacionados

CVE-2026-2113

Produtos afetados

Webuploader

Ftp Admin

Referências · 10

• 🔥 https://github.com/sTy1H/CVE-Report/blob/main/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.md · Exploit
• https://vuldb.com/?submit.746795 · Nota
• https://t.me/CVEtracker/44051 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2020246663516889414 · Publicação no Twitter
• https://vuldb.com/?id.344688 · Nota
• https://vuldb.com/?ctiid.344688 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2113 · Nota de Segurança
• https://t.me/cveNotify/154396 · Publicação no Telegram
• https://t.me/cveNotify/151264 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2113 · Aviso do Fabricante